Circuits and methods for modular exponentiation

Abstract

The modular exponentiation function used in public key encryption and decryption systems is implemented in a standalone engine having at its core modular multiplication circuits which operate in two phases which share overlapping hardware structures. The partitioning of large arrays in the hardware structure, for multiplication and addition, into smaller structures results in a multiplier design comprising a series of nearly identical processing elements linked together in a chained fashion. As a result of the two-phase operation and the chaining together of partitioned processing elements, the overall structure is operable in a pipelined fashion to improve throughput and speed. The chained processing elements are constructed so as to provide a partitionable chain with separate parts for processing factors of the modulus. In this mode, the system is particularly useful for exploiting characteristics of the Chinese Remainder Theorem to perform rapid exponentiation operations. A checksum mechanism is also provided to insure accurate operation without impacting speed and without significantly increasing complexity. While the present disclosure is directed to a complex system which includes a number of features, the present application is particularly directed to circuits and methods for carrying out modular exponentiation.

Description

BACKGROUND OF THE INVENTION [0001] The present application is directed to a method and apparatus for performing encryption and decryption. The application discloses several inventions relating to an overall system for the use of exponentiation modulo N as a mechanism for carrying out the desired cryptological goals and functions in a rapid, efficient, accurate and reliable manner. A first part of the disclosure is related to the construction of a method and its associated apparatus for carrying out modular multiplication. A second part of the disclosure is directed to an improved apparatus for carrying out modular multiplication through the partitioning of the problem into more manageable pieces and thus results in the construction of individual identical (if so desired) Processing Elements. A third part of the disclosure is directed to the utilization of the resulting series of Processing Elements in a pipelined fashion for increased speed and throughput. A fourth part of the discl...

AI Technical Summary

Benefits of technology

[0011] There are two items to note in particular about this method for carrying out modulo N multiplication. The first thing to note is that the multiplication is based upon a partitioning of one of the factors into sub-blocks with k bits in each block. This greatly simplifies the size of multiplier arrays which need to be constructed. It furthermore creates a significant degree of parallelism which permits the multiplication operation be carried out in a much shorter period of time. The second item to note is that the partitioning also results in the splitting of the process not only into a plurality of m cycles, but also, splits the method into two phases that occur in each cycle. In the first phase (X-phase), the values Xi and yi are computed. In the second phase (Z-phase), the intermediate result value Zi+1 is calculated. It should be noted that, in the calculation of Xi and in the calculation of Zi+1, there is an addition operation and a multiplication operation. This fact allows the same hardware which performs the multiplication and addition in each of these steps to be shared rather than duplicated. With respect to the division by R in the formation of Zi+1, it is noted that this is accomplishable by simply discarding the low order k bits. Other advantages of this structure will also become apparent.

[0051] It is also an object of the present invention to produce a high-speed, high-performance cryptographic engine.

Problems solved by technology

However, even though there is a desire for inclusion of a large number of bits in each factor, the speed of calculation becomes significantly slower as the number of digits or bits increase.

However, for real-time cryptographic purposes, speed of encryption and decryption are important concerns.

519-521, Peter L. Montgomery describes an algorithm for “Modular Multiplication without Trial Division.” However, this article describes operations that are impractical to implement in hardware for a large value of N. Furthermore, the method described by Montgomery operates only in a single phase.

Images